Sublime MQL rules: job

type.inbound
and (
  (
    // job scam in current thread
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("job_scam") and .confidence != "low"
    )
    // and salary mention in current thread
    and regex.icontains(body.current_thread.text,
                        '\$\d{3} weekly',
                        'week \$\d{3}',
                        'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
    )
  )
  // job scam in previous thread
  or any(body.previous_threads,
         any(ml.nlu_classifier(.text).intents,
             .name in ("job_scam") and .confidence != "low"
         )
         // and salary mention in previous thread
         and regex.icontains(.text,
                             '\$\d{3} weekly',
                             'week \$\d{3}',
                             'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
         )
  )
  // job scam lure delivered as a PDF with an empty email body
  or (
    length(body.current_thread.text) == 0
    and length(attachments) == 1
    and any(filter(attachments, .file_type == "pdf"),
            any(file.explode(.),
                // specific weekly salary pattern in the OCR
                regex.icontains(.scan.ocr.raw,
                                '\$\d{3} week',
                                'week \$\d{3}',
                                'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
                )
                and regex.icontains(.scan.ocr.raw,
                                    'fully remote',
                                    'remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)',
                                    'remotely',
                                    'work[\s-]?from[\s-]?home',
                                    'equal opportunity employer',
                                    'how to apply',
                                    'submit (?:your )?application',
                                    'remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)',
                                    'remotely',
                                    'work[\s-]?from[\s-]?home',
                                    'equal opportunity employer',
                                    'how to apply',
                                    'submit (?:your )?application',
                                    'open to all (?:majors|backgrounds|students)',
                                    'employment opportunity',
                                    '\bhiring\b'
                )
                and not regex.icontains(.scan.ocr.raw,
                                        'unemployment',
                                        'monetary (?:re)?determination',
                                        'weekly benefit amount',
                                        'supplemental unemployment',
                                        'work search activit'
                )
            )
    )
  )
)
and length(body.current_thread.links) < 10

// negating income / job verification senders
and not (
  sender.email.domain.root_domain in (
    'loandepot.com',
    'sofi.com',
    'lensa.com',
    'indeed.com',
    'ziprecruiter.com',
    'glassdoor.com',
    'postjobfree.com',
    'jobplacements.com'
  )
  and headers.auth_summary.dmarc.pass
)